Successful Internal Audit Planning and Execution

During the session, Internal Audits: From Strategic Planning to Effective Follow‑Up, moderated by Karyn M. Campbell Senior Director, QA Audit and Compliance, AbbVie, at the PDA/FDA Joint Regulatory Conference, speaker Helen Motamen, MS, global head, Sanofi Quality Audit, Inspection, Intelligence & Advocacy, at Sanofi, gave a presentation, titled “Planning and Executing the Internal Audit”, in which she emphasized the importance of performing internal audits.

“Someone will receive what you manufactured.” That single line anchored Motamen's presentation, which featured photographs of patients on the receiving end of manufactured products, a reminder that an internal audit isn’t a paperwork exercise. Internal audits are a direct line of defense between a shop floor and the person who ultimately takes the medicine, Motamen stressed.

Motamen framed audit risk in 3 dimensions (strategic, tactical, and operational) before turning to what she called the real drivers of a strong internal audit program: the team, the agenda, and how findings get delivered. Effective auditors, she said, combine rooted character traits (integrity, resourcefulness, persistence) with interpersonal skills (communication, curiosity, data-driven synthesis) and technical grounding in subject matter and regulatory requirements. Crucially, “auditors must have independence from the topic(s) being evaluated.” Qualification doesn't stop at onboarding, either. Motamen described a progression from initial training through continued, lifelong learning and, for some, external certification, explicitly rejecting tenure alone as a marker of readiness.

Team composition matters as much as individual skill. Motamen laid out the tradeoffs among internal auditors (institutional knowledge, cost efficiency), external auditors (independence, cross-industry pattern recognition), and cross-functional experts brought in for technical topics such as artificial intelligence (AI), machine learning, and visual inspection, with staffing strategy and backup plans decided well in advance.

On agenda design, Motamen's central point was that risk should drive time allocation rather than treating every system equally. A risk-based approach can help one prioritize where audit time and efforts, a principle Motamen extended to internal programs, weighing deviation trends, time since the last audit, staff turnover, and facility age. She also framed bottom-up (starting from records) and top-down (starting from system design) approaches as complementary rather than competing, with a mature agenda using both.

Delivery modality drew particular attention. Remote and hybrid audits are “no longer pandemic-era workarounds,” Motamen said, and can handle data-mining and some structured interviews effectively. But shop-floor time, gowning practices, and the texture of daily work still require an on-site presence, because, as she put it, “quality culture is an important leading indicator and is best sensed on-site.” A 2015 analysis on the metrics of quality culture similarly cautioned that culture is “difficult to quantify” through signatures or corrective actions and preventive actions (CAPA) statistics alone, reinforcing why Motamen leans on direct observation.1

The session also addressed auditing AI-enabled systems. Motamen pointed to the European Medicines Agency’s and the FDA’s 10 principles for good AI practice across the medicine lifecycle,2 plus a 2026 warning letter, as evidence that “regulations [are] forming” around this space.3 That letter, PharmTech reported, established that “AI-assisted drafting requires the same quality controls as traditional document preparation”", a standard Motamen translated into concrete audit questions: data provenance, model version control, human-in-the-loop oversight, drift monitoring, and explainability.

Motamen closed by saying that well-qualified auditors, a risk-based agenda balancing structure and agility, and willingness to probe new technology are what turn internal audit into a genuine feedback loop, one that protects patients, ensures compliance, and drives quality culture.

The PDA/FDA Joint Regulatory Conference is happening from September 14-16, 2026 in Washington, DC.

References

1. Harrison A and Schniepp SJ. The Metrics of Quality Culture. Pharmaceutical Technology 2015 39 (9). https://www.pharmtech.com/view/metrics-quality-culture
2. Cole C. EMA and FDA collaborate on framework for AI use in drug development. PharmTech.com. January 14, 2026. https://www.pharmtech.com/view/ema-and-fda-collaborate-on-framework-for-ai-use-in-drug-development
3. Pandey G and Borshchenko S. What FDA’s AI warning letter tells us about GMP accountability. PharmTech. Quality and Regulations 2026 eBook. 2026. https://www.pharmtech.com/view/what-fda-s-ai-warning-letter-tells-us-about-gmp-accountability